Exploração pública

Catálogo de exploits

Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.

77.133exploits catalogados

35.369CVEs com exploração pública

24.695testados em laboratório

Todos Exploit-DB 24.451Referência 22.232GitHub PoC 14.112VulnCheck XDB 8.607Nuclei 4.257Metasploit 3.474✓ só verificadosrecentes populares risco

22.232 exploits

Referência

CVE-2026-41460

CVE-2026-41460CRITICAL

SocialEngine <= 7.8.0 SQL Injection via activity/index/get-memberall

48RISCO

abrir ↗

Referência

CVE-2026-4512

CVE-2026-4512LOW

WP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSS

28RISCO

abrir ↗

Referência

CVE-2026-4106

CVE-2026-4106MEDIUM

HT Mega < 3.0.7 – Unauthenticated PII Disclosure

48RISCO

abrir ↗

Referência

CVE-2026-6878

CVE-2026-6878MEDIUM

ByteDance verl grader.py math_equal sandbox

33RISCO

abrir ↗

Referência

CVE-2026-6874

CVE-2026-6874MEDIUM

ericc-ch copilot-api Header token dns rebinding

33RISCO

abrir ↗

Referência

CVE-2026-40517

CVE-2026-40517HIGH

radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

41RISCO

abrir ↗

Referência

CVE-2026-34413

CVE-2026-34413HIGH

Xerte Online Toolkits Missing Authentication via connector.php

56RISCO

abrir ↗

Referência

CVE-2026-34415

CVE-2026-34415CRITICAL

Xerte Online Toolkits File Upload RCE via elfinder Connector

63RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute NewsLetter 6.1 - Insecure Cookie Handling

CVE-2008-6861—webappsphp

Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative

23RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute Content Rotator 6.0 - Insecure Cookie Handling

CVE-2008-6862—webappsphp

Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting

23RISCO

abrir ↗

Referência✓ VexDay Proof

Absolute Live Support 5.1 - Insecure Cookie Handling

CVE-2008-6864—webappsphp

Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative a

23RISCO

abrir ↗

Referência✓ VexDay Proof

merlix educate servert - Authentication Bypass / File Disclosure

CVE-2008-6870—webappsasp

Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information

23RISCO

abrir ↗

Referência✓ VexDay Proof

merlix educate servert - Authentication Bypass / File Disclosure

CVE-2008-6871—webappsasp

Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers t

23RISCO

abrir ↗

Referência✓ VexDay Proof

Active Web Mail 4 - Blind SQL Injection

CVE-2008-6873—webappsasp

SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the Tab

23RISCO

abrir ↗

Referência✓ VexDay Proof

ASPSiteWare Automotive Dealer 1.0/2.0 - SQL Injection

CVE-2008-6874—webappsphp

Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQ

23RISCO

abrir ↗

Referência

CVE-2010-4721

CVE-2010-4721—

SQL injection vulnerability in news.php in Immo Makler allows remote attackers to execute arbitrary SQL commands via the

23RISCO

abrir ↗

Referência

CVE-2017-9810

CVE-2017-9810—

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Mai

23RISCO

abrir ↗

Referência

CVE-2017-9810

CVE-2017-9810—

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Mai

23RISCO

abrir ↗

Referência

CVE-2017-9822

CVE-2017-9822HIGHsob ataqueransomware

DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code e

100RISCO

abrir ↗

Referência

CVE-2026-7214

CVE-2026-7214MEDIUM

eghuzefa engineer-your-data server.py file_inf path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7213

CVE-2026-7213MEDIUM

ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7212

CVE-2026-7212MEDIUM

edvardlindelof notes-mcp notes_mcp.py path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7211

CVE-2026-7211MEDIUM

dvladimirov MCP Git Search API mcp_server.py GitSearchRequest command injection

33RISCO

abrir ↗

Referência

CVE-2026-7206

CVE-2026-7206MEDIUM

dubydu sqlite-mcp entry.py extract_to_json sql injection

33RISCO

abrir ↗

Referência

CVE-2026-7205

CVE-2026-7205MEDIUM

duartium papers-mcp-server main.py search_papers path traversal

33RISCO

abrir ↗

Referência

CVE-2026-7204

CVE-2026-7204CRITICAL

Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection

48RISCO

abrir ↗

Referência

CVE-2026-7203

CVE-2026-7203CRITICAL

Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection

48RISCO

abrir ↗

Referência

CVE-2026-38651

CVE-2026-38651HIGH

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jw

41RISCO

abrir ↗

Referência

CVE-2026-7202

CVE-2026-7202CRITICAL

Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection

48RISCO

abrir ↗

Referência

CVE-2026-7146

CVE-2026-7146MEDIUM

AlejandroArciniegas mcp-data-vis HTTP Request server.js axios server-side request forgery

33RISCO

abrir ↗

Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.